Why Your VPN Drops Every 30 Minutes on Windows 10/11
L2TP VPN connections fail or drop after 30 minutes due to NAT traversal or IPsec dead peer detection. The fix is a registry tweak or router config.
When This Error Shows Up
You connect to a company VPN over L2TP/IPsec. Works fine for exactly 30 minutes. Then it disconnects. You reconnect, it works another 30 minutes. This is a known pattern on Windows 10 and 11 machines behind a home router or corporate NAT. The error logged in Event Viewer is usually Error 809 — "The network connection between your computer and the VPN server could not be established because the remote server is not responding."
What Actually Causes This
The culprit here is almost always IPsec Dead Peer Detection (DPD). Windows sends a keep-alive packet to the VPN server. If the server doesn't respond within a default timeout, Windows kills the tunnel. On a NAT'd connection (most home networks), the router's session table times out faster than the VPN's DPD interval. The router drops the NAT mapping, the VPN server thinks the client is dead, and the connection dies at 30 minutes.
Some VPN servers also enforce a 30-minute idle timeout. But nine times out of ten, it's the NAT traversal issue. The fix is to tweak the Windows registry to send more frequent DPD packets or adjust the NAT keep-alive interval.
The Fix: Registry Changes
Do not bother disabling IPsec entirely. That breaks security. And don't waste time reinstalling the VPN client — that rarely helps. Here's what works:
- Open Regedit as Administrator.
- Navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters - Create a new DWORD (32-bit) value named NegotiateDH2048_AES256 and set it to 0. This disables the more secure but problematic DH2048 key exchange that some VPN servers don't handle well.
- Create another DWORD: ProhibitIpsec. Set it to 0 (keep IPsec enabled).
- Now find or create IdleDisconnectSeconds in the same path. Set this to 0 to disable the idle timeout.
- Restart the Remote Access Connection Manager service or reboot the machine.
Alternative fix (if the above doesn't work): Add a DWORD named AssumeUDPEncapsulationContextOnSendRule at HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent and set it to 2. This forces Windows to assume the VPN server supports NAT traversal. This one's been reliable since Windows 7 days.
Still Drops? Check These Three Things
1. Router Session Timeout
Log into your router. Look for UDP Timeout or Session Timeout settings. If it's set to 1800 seconds (30 minutes), change it to 3600 seconds or higher. Some consumer routers hide this — check under Advanced > Security > NAT.
2. VPN Server Idle Policy
Ask your IT team if the server enforces a 30-minute idle disconnect. On Windows Server, that's in Routing and Remote Access > Properties > Security tab. If they can't change it, you'll need a keep-alive script.
3. Network Adapter Power Saving
Open Device Manager. Find your network adapter. Under Power Management tab, uncheck "Allow the computer to turn off this device to save power". This one's a common gotcha on laptops.
Pro tip: If you're on a corporate laptop with strict group policies, none of these registry changes may stick. In that case, check with IT to add a persistent route or push the DPD settings via Group Policy. Or use a third-party VPN client like OpenVPN — it handles NAT traversal way better than the built-in L2TP client.
What to Do If It Still Fails
If you've done all of the above and the VPN still drops at 30 minutes, run netsh ras show tracing to enable verbose logging. Look for "DPD timeout" or "NAT keep-alive failed" in the debug logs. Sometimes the fix is as simple as switching the VPN protocol from L2TP to SSTP — SSTP runs over TCP port 443 and doesn't have the same NAT traversal issues. Most corporate VPNs support SSTP these days.
Was this solution helpful?